HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Dec. 22, 2017.
- Organization as reported
- SAY San Diego, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- Dec. 22, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13960, row:5099)
- Archived copy
- Held in the private archive (provenance)
On October 27, 2017, the covered entity (CE), SAY San Diego, was notified by the County of San Diego Health & Human Services Agency that a citizen had returned paper files containing protected health information (PHI) to its office that were found in a filing cabinet purchased from a salvage store. The CE confirmed that the files were related to youth participants in its dual diagnosis program from January through June 2013. The breach included the clinical and demographic information of 1,272 individuals. The CE provided breach notification to affected individuals, prominent media outlets, and HHS and offered individuals one year of free identity monitoring services. In response to OCR’s investigation, the CE revised its policy and procedure on the disposal of PHI and electronic PHI and provided additional training to the workforce member responsible for the breach.